Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
Microsoft

Microsoft Recall Screenshots Credit Cards, Social Security Numbers (tomshardware.com) 104

Posted by BeauHD from the not-a-good-look dept.
An anonymous reader quotes a report from Tom's Hardware, written by Avram Piltch: Microsoft's Recall feature recently made its way back to Windows Insiders after having been pulled from test builds back in June, due to security and privacy concerns. The new version of Recall encrypts the screens it captures and, by default, it has a "Filter sensitive information," setting enabled, which is supposed to prevent it from recording any app or website that is showing credit card numbers, social security numbers, or other important financial / personal info. In my tests, however, this filter only worked in some situations (on two e-commerce sites), leaving a gaping hole in the protection it promises.

When I entered a credit card number and a random username / password into a Windows Notepad window, Recall captured it, despite the fact that I had text such as "Capital One Visa" right next to the numbers. Similarly, when I filled out a loan application PDF in Microsoft Edge, entering a social security number, name and DOB, Recall captured that. (Note that all info in these screenshots is made up). I also created my own HTML page with a web form that said, explicitly, "enter your credit card number below." The form had fields for Credit card type, number, CVC and expiration date. I thought this might trigger Recall to block it, but the software captured an image of my form filled out, complete with the credit card data. Recall did refuse to capture the credit card fields on the payment pages of Pimoroni and Adafruit. "So, when it came to real-world commerce sites that I visited, Recall got it right," adds Piltch. "However, what my experiment proves is that it's pretty much impossible for Microsoft's AI filter to identify every situation where sensitive information is on screen and avoid capturing it."
This discussion has been archived. No new comments can be posted.

Microsoft Recall Screenshots Credit Cards, Social Security Numbers More

Microsoft Recall Screenshots Credit Cards, Social Security Numbers

Comments Filter:

  • Steal Everything is NOT the Job of an OS (Score:5, Insightful)

    by BrendaEM ( 871664 ) on Thursday December 12, 2024 @06:53PM (#65009191) Homepage
    The FTC is asleep at the switch, again.

    • The FTC is asleep at the switch, again.

      Whatever the reason, this is a seriously egregious problem. I am almost Microsoft free, but what I do on my one windows computer has a whole lot of information that shouldn't be shared. Names, Phone numbers, and other information that no one has any business knowing outside of those who need to know.

      But this is a way to screenshot everything on your computer, and if people trust Microsoft to not collect everything, then they are naive.

      I'm pretty certain that Redmond will share everything with LEO if as

      • ...but what I do on my one windows computer...

        Why not use a mac for that?

        Remember, every time you use Windows, the terrorists win.

        • ...but what I do on my one windows computer...

          Why not use a mac for that?

          Remember, every time you use Windows, the terrorists win.

          I have some analysis software that only runs on Windows.

          • Re: (Score:2)

            by ls671 ( 1122017 )

            Try running it with WINE on linux, chances are good it will work. I have had great success with many pieces of software so far.

            • Considering how long he's been around here, I think Ol has probably more experience with WINE than 90% of people on here.

              If the machine is only used for this one piece of software, and you airgap it (this is an MS machine!) the question has to be asked, why does the analysis need SSNs, CC numbers, etc? Depend's what is being analysed, I guess. but if the one "analysis" task is also covering for convenience for some banking app that requires "current Edge" (for example) that would be more of an issue. But -

              • Considering how long he's been around here, I think Ol has probably more experience with WINE than 90% of people on here.

                If the machine is only used for this one piece of software, and you airgap it (this is an MS machine!) the question has to be asked, why does the analysis need SSNs, CC numbers, etc? Depend's what is being analysed, I guess. but if the one "analysis" task is also covering for convenience for some banking app that requires "current Edge" (for example) that would be more of an issue. But - didn't we have, and largely win, that war back in the mid-2000s? software writers had no choice but to serve the needs of iDevice users, Android users &c, so pretty much had to strip out their IE-specific code, and learned the lesson.

                I'll bet that the "analysis software" hasn't had an update this decade, which would raise eyebrows on a security front.

                Regardless, "Ol" is big enough to address these concerns himself.

                It's been 2 years since an update, so while not perfect, it's not too bad. It does require internet access for part of its operation, which is accessing F.C.C. databases. I can run it offline for portions of the work.

                Wine - while a lot of things work, there are so often little "gotchas" that happen, sometimes you don't know until they show up. I had one specialized database that worked seamlessly on Wine except for one small thing, then crashed the computer. It was a while back, and IIRC it was something

                • The work computer is provided, so I don't mess with the OS - but we'll see how this recall situation pans out.

                  Since "Work" seems to require things like "live access of FCC databases", I'll bet there are a metric shit-ton of regulatory issues you have to deal with - for that part of "work", at least. Keep the "Recall" thing on "amber flag" for the work IT people, and ask them about it every few months, and that should be you covered. When something goes badly wrong, the discovery of internal emails will sh

                  • The work computer is provided, so I don't mess with the OS - but we'll see how this recall situation pans out.

                    Since "Work" seems to require things like "live access of FCC databases", I'll bet there are a metric shit-ton of regulatory issues you have to deal with - for that part of "work", at least.

                    Oh gawd yes. Keeping everything and everyone in their lanes plus keeping the F.C.C. happy is quite the effort at times. And the rules constantly change as cellular providers believe that they need every frequency on earth so people can look at pR0n and TikTok videos on their smartphones.

                    I had one of these printed as a wall chart https://www.ntia.gov/sites/def... [ntia.gov]

                    So if someone comes in demanding some spectrum, I tell them to pick where they want to be. They usually get all excited at the empty spot arou

                    • so Recall will be an issue. I wonder if I can make every screenshot look like a tube of Preparation H?

                      Hmmm, can you set it up with a multiple desktop configuration, and have one of the desktops looping a video of preparation-H application, while you work on a different desktop? That won't make every screenshot a preparation-H one, but a lot of them will be.

                    • Hmmm, can you set it up with a multiple desktop configuration, and have one of the desktops looping a video of preparation-H application,

                      And this sir, was the first thing I saw today. Oh my gawd, a video of its application! 8^) Considering it is Microsoft, damn appropriate.

                      First thing Monday morning, and you won the internet for the week.

                    • I sink to please.

      • The FTC is asleep at the switch, again.

        Whatever the reason, this is a seriously egregious problem. I am almost Microsoft free, but what I do on my one windows computer has a whole lot of information that shouldn't be shared. Names, Phone numbers, and other information that no one has any business knowing outside of those who need to know.

        But this is a way to screenshot everything on your computer, and if people trust Microsoft to not collect everything, then they are naive.

        I'm pretty certain that Redmond will share everything with LEO if asked, and LEO will want names addresses, times, and places, transactions and whatever else can be gleaned. Bet on it.

        Redmond would share everything with anyone who is willing to pay for it. It's a for profit company. And we all know that that absolves them of any responsibility other than making money, at all costs. Luckily, most of us aren't worth enough for somebody to buy our secrets. It's still an egregious and shit practice, from an egregious and shit company, hell-bent on control over service, but what else would we expect? It's not like we haven't seen the writing on the wall when it comes to security and Microsoft

    • Re: Steal Everything is NOT the Job of an OS (Score:5, Insightful)

      by drinkypoo ( 153816 ) <drink@hyperlogos.org> on Thursday December 12, 2024 @07:32PM (#65009311) Homepage Journal

      Microsoft is part of PRISM.

      That means this is by design at all levels.

      They are a defense contractor and part of the panopticon, you think the government is going to stop itself from spying?

      • Which government?

        Your government?

        My government?

        Or (to pick a third party not quite at random), "angel'o'sphere [slashdot.org]" 's government?

        That's a remarkable level of implied competence,

        • Which government?
          Your government?

          Any of these governments [wikipedia.org], plus any of the other governments which work closely with them, for over eight decades.

          That's a remarkable level of implied competence,

          Competence? Spying is easy, kiddies can do it. And it's even easier if you build it into the OS. Keeping data secure is what's hard.

      • They are a defense contractor and part of the panopticon, you think the government is going to stop itself from spying?

        If the government is honest and honorable, it would stop itself from spying in that manner. In the USA, it is part of the basic documents that formed the country... but here we are somehow. There is very little honor left.

    • Aren't the screenshots just being stored locally? So, technically, not stolen until some malware comes along and lifts your screenshots. But here's the thing about malware: nothing is preventing an infected computer from logging your keystrokes and/or taking its own screenshots and sending them to some malicious actor.

      Now don't get me wrong, Recall potentially makes it faster for a pwned Windows machine to ruin your day, but the root (pun intended) issue is one of security (or lack thereof), unless you t

      • One should certainly be concerned about keyloggers and the various credential(and sometimes browser history) scraping and exfiltration tools; but Recall makes the situation worse in the sense that malware can only really work with either something that was captured by something else and stored prior to its introduction or with things that wouldn't ordinarily be captured during the time between being planted and being discovered.

        Adding a vendor-blessed mechanism for fairly comprehensive history to be coll

      • Re: (Score:1)

        by Anonymous Coward

        This is total bullshit. Recall is a much, much higher risk than random malware. It's sitting there, built in to the OS, immune to detection by any anti-malware. It's retrospective, with everything you've done recently stored.

        You get a keylogger installed (after it gets past your anti-malware software), it only gets as much data as it can grab going forward until it's detected. You get recall stealing malware, it gets *everything* in 5 minutes and could then delete itself without trace. It doesn't have to ho

    • In Soviet Russia, software pirate you!

    • Steal for whom? Recall exists to record the user for the user. If you're entering your credit card blindly into other people's PCs you deserve to have your bank account emptied. And on your own PC... whoope de fucking do, Recall is protected with the same mechanism Chrome uses to protect your credit card pre-fill information - PC security.

      Protect your device, it's more valuable than you think, and if you're only finding out about it because of Recall stories then it *REALLY* is more valuable than you think.

  • So... great, you have an algorithm going around blurring data it doesn't think you should look at.

    It's not going to get everything right. Not even close. Not unless it bugs you to confirm when it does it.

    So essentially it is built-in censoring of recall feature. So what happens when you legit have some information you need to pull out of the recall feature... and you find it has been flagged as sensitive and is blurred... and unrecoverable?

    To give a real-life example, the algorithm Google uses to blur li

    • Well, you only need to switch to map mode, then you see it again.

      Perhaps people get scared when they see their street address and house number? And complained?

  • Good Time to Try Linux! (Score:5, Insightful)

    by BrendaEM ( 871664 ) on Thursday December 12, 2024 @06:59PM (#65009203) Homepage
    https://www.linuxmint.com/ [linuxmint.com]

    • Wait until the systemd folks release something similar next year.

      • One could write a 100 line bash script right now that does the same (calls screenshot utility, runs tesseract OCR, filter out files that contain taboo words, delete old files). Still the big difference is both systemd or a custom script would keep the data on your local computer.

        • One could write a 100 line bash script right now that does the same (calls screenshot utility, runs tesseract OCR, filter out files that contain taboo words, delete old files). Still the big difference is both systemd or a custom script could keep the data on your local computer.

          FTFY

    • Linux for the unwashed masses is called Android. The idea that Microsoft's enshitification of Windows is ever going to push a majority of desktop PC users towards Linux, though, is such a long-running trope on Slashdot that it's basically just a tongue-in-cheek meme at this point.

  • In other news... (Score:5, Interesting)

    by sarren1901 ( 5415506 ) on Thursday December 12, 2024 @07:01PM (#65009211)

    water is wet and the sun is bright. Of course this pos software Microsoft is trying to force onto Windows users is a terrible idea. It's essentially just a dragnet to suck up personal data and user behavioral patterns.

    Sure, this could be used to empower the individual but given how our world really works, will be used to empower Microsoft and possible used to help automate away even more work. If we had resource distribution figured out properly and fairly, this wouldn't be a bad thing but since the goal of Western society seems to be to reduce payroll while maximizing shareholder value, I don't see this benefiting the average person. At all.

    • Comment removed (Score:5, Insightful)

      by account_deleted ( 4530225 ) on Thursday December 12, 2024 @07:22PM (#65009275)
      Comment removed based on user account deletion

      • The feature isn't free, it's designed to keep selling Windows licenses. There's a cost associated, you just don't see it broken down in an itemised feature list.

      • > Rule of thumb is that if Microsoft made it, it won't work right*

        * right - meaning the way you think it should work, or indeed the way any reasonable, sensible and generally balanced person would consider it should work.

        Microsoft does things to suit itself. It does them in a way that suits itself. It's why they keep messing with the Start menu, it's why they keep hiding settings in different menus. It's why they introduced this feature in the first place, and the way it works now is by design - either e

  • Going to production no matter what (Score:3)

    by nwaack ( 3482871 ) on Thursday December 12, 2024 @07:02PM (#65009213)
    For nefarious reasons we, as the consumer, will never be privy to, MS is going to roll this out no matter what...customer be damned as usual.

    • Re: (Score:2)

      by vbdasc ( 146051 )

      Why do some people continue to believe that Windows users are the MS' customers?

      • Re: (Score:2)

        by nwaack ( 3482871 )
        I don't believe this, but using the phrase "product for the real customers - the giant corporations paying MS for ad space, and the U.S. government - " instead of "consumer" made the post clunky :)

  • There were folks saying it would do this up front. Those folks were mostly said to shut up, because reasons. And here we are.

    Microsoft may have a vague idea of what security is, but only after they step directly the opposite direction and get pimped slapped publicly for it. Unfortunately, they seem to like the slaps, because they just keep going the wrong direction.

  • I will try to stop this nonsense.

  • Nothing to worry about; that new AI browser thingy that Google is rolling out that pretends to be you on the internet including filling out forms and buying stuff on your behalf? That will make sure you never have to enter your personal details ever again, so Microsoft won't be able to see it!

    Modern problems require modern solutions!
    =Smidge=

    • Re: (Score:2)

      by vbdasc ( 146051 )

      Expect MS to release their own Internet using agent thingy too...

    • Nothing to worry about; that new AI browser thingy that Google is rolling out that pretends to be you on the internet including filling out forms and buying stuff on your behalf? That will make sure you never have to enter your personal details ever again, so Microsoft won't be able to see it!

      Modern problems require modern solutions! =Smidge=

      The Google browser thingy has to be in the forefront, so Recall will see the personal details it shares while it's copy-pasting your personal info all over the web impersonating you. It's info-suck all the way down, man. Enjoy the ride.

  • It's hard to identify sensitive numbers without false positives.

    Sure, you can do it if you have some idea how the data is structured, but if you have something like this in a PDF:

    Doe, John 234-56-7890 SS 567-89-0123

    Is either or both of the numbers a Social Security Number or other sensitive number? Maybe, maybe not.

  • When I entered a credit card number and a random username / password ... [with] text such as "Capital One Visa" right next to the numbers. ...
    I filled out a loan application PDF in Microsoft Edge, entering a social security number, name and DOB, Recall captured [all] that ...

    (Note that all info in these screenshots is made up).

    Microsoft/Recall knows it was made-up info.

  • He says that he made up the credit card number, but it doesn't pass the Luhn credit card checksum test, so there was no reason to filter it.

    • Re: (Score:1)

      by Anonymous Coward

      The cases where it did work to obscure credit card info are probably because they were web pages: the input tags would have contained autocomplete attributes related to credit cards, e.g.:

      • cc-csc
      • cc-exp
      • cc-name
      • cc-number
      • cc-type

      No, this whole Microsoft Recall thing is doomed to fail. It has no practical real world use for end users, it's all about hoovering up private information for the five eyes... in which case it's a glowing success story!

  • When in any doubt, Microsoft will always think of the safety of your data first. That's why, when the algorithm can't determine if sensitive data is on the screen, it will take the screenshot anyway just to be safe.

  • Who in the fuck asked or this dumb fucking shit?

  • HIPPAA (Score:3, Informative)

    by Coius ( 743781 ) on Thursday December 12, 2024 @09:25PM (#65009539)

    Amazingly, if any of this information is on hospital computers or insurance company machines that work with medical information, it will violate HIPPAA thousands of times a day if it ends up sharing it with Redmond. I wonder how expensive that kind of thing will get when hospitals unwittingly violate HIPPAA with sharing sensitive info with those who are not privvy to the info, and when it comes to photos, there are two photo parts in that law this would violate, especially regarding personally indentifiable info.

    • For those not in America, I had to remind myself what "HIPPAA" means.

      Ah, that doesn't help. I think the acronym should be "HIPAA [wikipedia.org]"

      Wiki : "It aimed to alter the transfer of healthcare information, [blah]. It generally prohibits healthcare providers and businesses called covered entities from disclosing protected information to anyone other than a patient and the patient's authorized representatives without their consent."

    • Indeed, if the feature works the way the Slashdot septic thinktank thinks it works it would be a HIPAA violation. But it doesn't, so it isn't. You really think your entire screen session is being shared in virtual realtime with Microsoft? I mean you can disprove that simply by looking at the upstream bandwidth on your router and using a calculator, without even needing to do packet inspection.

    • Re: (Score:2)

      by mjwx ( 966435 )

      Amazingly, if any of this information is on hospital computers or insurance company machines that work with medical information, it will violate HIPPAA thousands of times a day if it ends up sharing it with Redmond. I wonder how expensive that kind of thing will get when hospitals unwittingly violate HIPPAA with sharing sensitive info with those who are not privvy to the info, and when it comes to photos, there are two photo parts in that law this would violate, especially regarding personally indentifiable info.

      Not to mention GDPR in the EU/UK.

    • it will violate HIPPAA thousands of times a day if it ends up sharing it with Redmond.

      LOL, so what? Someone has to actually enforce the law and it will most assuredly NOT be enforced in this regard.

      Laws will not save you as the people in charge no longer feel like they even have to give lip service to the law anymore.

    • Which would mean the DOJ, FBI and most police departments and courts will have Microsoft viewing and saving CHRI data.

  • I wonder if Team Windows realizes that their insanity is what will eventually
    push people into the waiting arms of a Linux Distro.

    I absolutely guarantee you Win 10 is the last version of Windows I will ever
    use.

    My Mint box will enjoy all the attention it gets going forward.

    • Re: (Score:2)

      by vbdasc ( 146051 )

      I absolutely guarantee you Win 10 is the last version of Windows I will ever use.

      That was my favorite saying once. My current one is that Win 11 is the last version of Windows I will ever use.

  • Finally a legitimate use for DRM (Score:3)

    by madbrain ( 11432 ) on Thursday December 12, 2024 @11:25PM (#65009699) Homepage Journal

    Run the entire browser in a DRM video context. This should stop Windows recall, and any other program, from taking screenshots. Of course, sometimes you do actually need those. Just can't have it all.

  • Impressive... (Score:3)

    by fuzzyfuzzyfungus ( 1223518 ) on Friday December 13, 2024 @02:01AM (#65009879) Journal
    I'd be a lot more sympathetic to the question of how to accurately filter out sensitive numbers; except that Microsoft is quite eager to upsell you on glorious "Microsoft Purview" data loss prevention technology that allegedly:

    "DLP detects sensitive items by using deep content analysis, not by just a simple text scan. Content is analyzed:

    For primary data matches to keywords
    By the evaluation of regular expressions
    By internal function validation
    By secondary data matches that are in proximity to the primary data match
    DLP also uses machine learning algorithms and other methods to detect content that matches your DLP policies"

    Either they are fairly shamelessly selling something that is largely unfit for purpose to Purview customers, or they specifically neglected to bring actually-functional heuristics over to 'Recall', or the actually-functional heuristics didn't fit in the resource constraints of the Recall environment and they are overselling whatever simplification remains.

    None of those options seem like good looks.

  • Sigh. (Score:3)

    by ledow ( 319597 ) on Friday December 13, 2024 @04:20AM (#65010005) Homepage

    I'm still trying to work out why I would want something randomly screenshotting my screen constantly and storing those screenshots on my computer forever.

    I don't really care what it blurs or doesn't. I want to know why you need that at all, as a user.

  • Recall is totally brain dead (Score:3)

    by TractorBarry ( 788340 ) on Friday December 13, 2024 @06:36AM (#65010153) Homepage

    The whole idea of recall is simply brain dead. One of the most stupid ideas I've seen in a long time.

    If you are in any doubt that Microsoft have completely lost the plot then recall should be the things that drives the point home - even to the most stupid user :)

    Windows is now actively hostile to the end user, has a totally insecure fundamental design (which can never be fixed by band aid after band aid of patches), and should now be viewed as full on malware. It's that simple.

  • Microsoft cannot do IT security for shit. No reason to expect this to be different.

  • Surely, if you set up your windows machine with multiple logical drives ("C:" for the OS, "D:" for users' directories, "W:" for Work, "P:" for porn ...) and make sure that after the OS and applications are installed there is only space for a few dozen (thousand, your choice) screen shots. Then MS (who never go outside "C:", as I remember) will have to stop Recall fairly quickly. Alternatively, if they do step outside "C:", it's likely to be pretty obvious where they're doing things.

    Yes, you need to do some

  • Every so often you see some app/feature/tool being shoved at consumers in tech.

    Google+ Forced into everything. This was horrible.
    Facebook forced everyone that used facebook to all of a sudden have an email account with them. This imploded very fast. But was replace by Facebook buying several chat services.
    Check marks on so many sites. X is an example. The check mark is effectively dead now.
    And that damn long key press dialogue that still plagues us to this day. Man I hate that thing.

    In almost every

  • Sounds like Microsoft's AI filter is actually just a blacklist of websites and not an AI analyzing what's on screen to determine whether it should save an image or not...
  • It filters out credit card information on legitimate sites. It will still capture credit card information on nefarious sites so you always have a reference to which phishing sites you entered your credit card information on.
    It's not a bug, it's a feature.

Slashdot Top Deals

Never keep up with the Joneses. Drag them down to your level. -- Quentin Crisp

Close